rule APT_APT34_Dustman_Apr_2021_1 {
   meta:
      description = "Detect the Installer of Dustman wiper used by APT34"
      author = "Arkbird_SOLG"
      reference = "Internal Research"
      date = "2021-04-28"
      hash1 = "a9397eb9e95087db7e03239c689776d56c1450d685568564acd90e1532c78882"
      tlp = "white"
      adversary = "APT34"
   strings:
      $s1 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 00 00 00 00 2f 63 20 61 67 65 6e 74 2e 65 78 65 20 41 00 00 44 00 6f 00 77 00 6e 00 20 00 57 00 69 00 74 00 68 00 20 00 42 00 69 00 6e 00 20 00 53 00 61 00 6c 00 6d 00 61 00 6e 00 00 00 00 00 5c 00 }
      $s2 = "\\assistant.sys" fullword wide 
      $s3 = { 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4f 00 72 00 61 00 63 00 6c 00 65 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 42 00 6f 00 78 00 00 00 00 00 54 68 65 20 4d 61 67 69 63 20 57 6f 72 64 21 00 56 00 42 00 6f 00 78 00 44 00 72 00 76 00 00 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 00 00 56 00 42 00 6f 00 78 00 55 00 53 00 42 00 4d 00 6f 00 6e 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 41 00 64 00 70 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 4c 00 77 00 66 }
      $s4 = { 5c 00 5c 00 2e 00 5c 00 25 00 73 }
      $s5 = { 68 54 00 00 00 68 00 00 00 00 68 80 69 40 00 e8 f4 0f 00 00 83 c4 0c 68 00 00 00 00 e8 ed 0f 00 00 a3 84 69 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 e8 da 0f 00 00 a3 80 69 40 00 e8 fc 2f 00 00 e8 7d 2c 00 00 e8 7a 18 00 00 e8 1d 12 00 00 e8 40 2d 00 00 68 00 00 00 00 e8 78 2f 00 00 a3 8c 69 40 00 68 00 00 00 00 e8 8d 2f 00 00 a3 90 69 40 00 c7 05 94 69 40 00 5a 00 00 00 c7 05 98 69 40 00 14 00 00 00 8b 1d 8c 69 40 00 2b 1d 94 69 40 00 83 c3 ea 89 1d 9c 69 40 00 8b 1d 90 69 40 00 2b 1d 98 69 40 00 83 c3 cc 89 1d a0 69 40 00 68 00 00 c8 00 68 18 60 40 00 ff 35 98 69 40 00 ff 35 94 69 40 00 ff 35 a0 69 40 00 ff 35 9c 69 40 00 68 00 00 00 }
      $s6 ="Release\\Dustman.pdb" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize > 50KB and 4 of them
}
